9 ms·
I would assume at googles scale that this has to be violated pretty often, how could you possibly police this well?
by buildbot 5y ago
I would assume at googles scale that this has to be violated pretty often, how could you possibly police this well?
- Hamuko 5y agoI assume they do license scanning at the very least.
- deleted 5y ago[deleted]
- Fiahil 5y agowe're not Google scale, but this works very well with precommit hooks and automatic CI checks that inspect dependencies for know vulnerabilities and incompatible licenses (you know, sonarqube and the likes). I would assume this is pretty well policed for all existing projects and by default for all new projects.
- fnbr 5y agoYou are only allowed to use imports that are in the monorepo, and each time a library is added to the monorepo, the license is checked.
- surajrmal 5y agoA lot of Google operates outside the monorepo these days.
- deleted 5y ago[deleted]
- klabb3 5y agoEvery single 3p library that's imported into Google's monorepo gets vetted for license. If it's one of the standard licenses, it gets approved somewhat fast, but it's still time time consuming.
- fmajid 5y agoI would assume any library is vetted for security, a company like Google cannot afford wild-west practices with dependencies. Adding a license audit to the process would not be a big imposition.
- klabb3 5y agoCorrect. The security vetting is indeed more cumbersome. All 3p code is reviewed with the same standards as internal projects, in theory.
- Rebelgecko 5y agoGoogle has tools for making sure that outgoing open source projects have kosher licensing (e.g. cross: https://opensource.google/documentation/reference/glossary#cross https://opensource.google/documentation/reference/glossary#c...). I wouldn't be surprised if there's something similar that runs on incoming code and freaks out if it sees the text "under the terms of the GNU Affero General Public License". It'd be hard to introduce AGPL code accidentally.